this post was submitted on 20 Sep 2024
247 points (95.9% liked)
Showerthoughts
29713 readers
1332 users here now
A "Showerthought" is a simple term used to describe the thoughts that pop into your head while you're doing everyday things like taking a shower, driving, or just daydreaming. A showerthought should offer a unique perspective on an ordinary part of life.
Rules
- All posts must be showerthoughts
- The entire showerthought must be in the title
- Avoid politics
- NEW RULE as of 5 Nov 2024, trying it out
- Political posts often end up being circle jerks (not offering unique perspective) or enflaming (too much work for mods).
- Try c/politicaldiscussion, volunteer as a mod here, or start your own community.
- Posts must be original/unique
- Adhere to Lemmy's Code of Conduct-----
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Biometrics should be usernames, not passwords. Fingerprints, irises, faces, vocal patterns, all of it, no matter how good it is, only identifies the person trying to enter/use something and is somewhat easy to steal without their knowledge.
If you want true security you still need to ask for a passcode that only the now-identified user will know.
And yes, it is still possible to intercept the passcode at the moment that the user interacts with the locking mechanism, but that is completely different from grabbing it when they're randomly walking down the street, etc.
(Edit to add: I didn't think this needed to be explained, but I'm not saying biometrics should replace usernames, I'm saying they shouldn't have replaced passwords. And yes, you can still use biometrics in the authentication process to identify that it's you, i.e. your username, but you still need a password.)
The only form of authentication that will work long term is to run a hash on the entire person.
Basically instead of authenticating that it is the same person, you authenticate that whatever is attempting access shares enough characteristics with that person to use the resource in the same way.
Like, a perfect transporter clone of me can get access to my stuff, but it’s okay because he’s got my same goals and moral constraints.
What if you want to have more than one account with a provider, but you have only one face?
Are you serious or are you being pedantic and trolling? That doesn't change my point, your face shouldn't be the password to both accounts. It's pretty easy to add another step for multiple accounts.
Ok, but the providers will not offer such a service. I'd gladly take 2fa using biometrics and a password/passkey with my username working as it always has.
I'm not saying biometrics should replace all usernames. I'm saying that they should be used as usernames/identification at best.
I have the same username at multiple websites...